rust-gvm 0.10.0

rust-gvm v0.10.0

rust-gvm v0.10.0 adds capability-gated, exact-byte GMP response streaming and
the first bounded streaming integration for native XML report pages. It also
adds typed semantic views of GMP server errors and feed synchronization state
while preserving the original protocol status, text, and wire values.

Callers upgrading from v0.9.0 should review the
v0.10.0 migration guide.
GmpRequestError is no longer Copy, streamed response failures invalidate
the connection unless the complete frame validates, and report-page traversal
must advance by the actual returned result count rather than the requested or
server-reported window size.

Highlights:

• generic GmpClient::execute_stream and execute_stream_with operations,
  statically gated by GmpStreamingResponse;
• exact response bytes with caller-driven backpressure, explicit completion,
  AsyncWrite copying, and deterministic connection lifecycle semantics;
• independent total-byte, retained-token, idle-timeout, and total-timeout
  policies for streamed responses;
• incremental XML framing that validates the root status before yielding bytes
  and supplies bounded, path-selected events to typed decoders;
• GetNativeReportPageRequest and NativeReportPageResponse for explicit,
  validated report windows with small completion metadata;
• continuation metadata based on the number of direct results actually
  returned, including safe handling of server page caps and empty pages;
• source-preserving GmpRequestError::FilterFragment diagnostics;
• shared GmpServerErrorKind classification and matching parser/client error
  accessors while retaining raw GMP status and status text;
• raw-preserving FeedSyncState semantics for missing, inactive, active, and
  unsupported feed synchronization wire forms;
• stricter XML character-reference validation that rejects signed and other
  non-XML lexical spellings;
• pageant 0.2.5, which bounds peer-controlled frames before buffering and
  fixes CVE-2026-116775's remote memory-exhaustion denial of service;
• reviewed dependency refreshes and Cargo Vet evidence;
• release binaries for five targets, each with a SHA-256 checksum;
• the Linux amd64/arm64 mock-server image at
  ghcr.io/greenbone-hive/gvm-mock-server:v0.10.0 (no moving latest tag);
• CycloneDX JSON and XML SBOMs, an SBOM quality report, checksums, and Sigstore
  provenance for downloadable artifacts and the container image.

The release artifacts are built from the immutable v0.10.0 tag and verified
against its exact qualified protected-main commit before publication completes.

rust-gvm 0.9.0

rust-gvm v0.9.0

rust-gvm v0.9.0 adds GOS-compatible SSH session/exec channels while preserving
direct stream-local forwarding as the default. It also establishes bounded
response, request, and session lifecycles across the client transports and
programmable mock server.

Callers upgrading from v0.8.0 should review the
v0.9.0 migration guide.
Existing SSH callers retain direct stream-local behavior. Exhaustive matches on
ParseError must account for NestingLimitExceeded, configured transport
timeouts now bound the complete response, and standalone non-loopback mock
listeners require an explicit --allow-non-loopback acknowledgement.

Highlights:

• opt-in SshChannelMode::Exec support for restricted or forced-command SSH
  accounts, including the empty exec request used by current GOS tooling;
• acknowledgement, rejection, timeout, early-close, retry, response-bound, and
  redaction handling for SSH exec channels;
• one total response deadline for Unix, TLS, and SSH clients, preventing peers
  from extending requests indefinitely by trickling partial XML;
• a structured typed-response nesting-limit error at 256 XML levels;
• a shared 64-session mock-server limit, a 30-second incomplete-request
  deadline, cancellation-aware shutdown, and authenticated-session cleanup;
• explicit opt-in for standalone TCP/TLS listeners that bind beyond loopback;
• corrected stateful start_task success text matching gvmd;
• protected-main release qualification and immutable workflow-tool inputs;
• dependency and RustSec remediation completed before the release candidate;
• release binaries for five targets, each with a SHA-256 checksum;
• the Linux amd64/arm64 mock-server image at
  ghcr.io/greenbone-hive/gvm-mock-server:v0.9.0 (no moving latest tag);
• CycloneDX JSON and XML SBOMs, an SBOM quality report, checksums, and Sigstore
  provenance for downloadable artifacts and the container image.

The release artifacts are built from the immutable v0.9.0 tag and verified
against its exact qualified protected-main commit before publication completes.

rust-gvm 0.8.0

rust-gvm v0.8.0

rust-gvm v0.8.0 adds the complete typed asynchronous report-export lifecycle
used by current gvmd and preserves additional typed fields that v0.7 silently
dropped. It also tightens stateful mock-server fidelity and bounds retained
command history.

Callers upgrading from v0.7.0 should review the
v0.8.0 migration guide.
Existing request calls remain available, but struct-literal construction of
GetAgentSupportBundleRequest must initialize its new encryption field, and
exhaustive consumers should account for the new typed projection payloads.

Highlights:

• typed queue, poll, download, and cancellation operations for scan, audit, and
  delta report exports, gated by GMP 22.7 plus positive command discovery;
• source-shaped export metadata and binary download responses;
• repeatable completed-export downloads aligned with gvmd's retention-only
  cleanup contract;
• preserved result-NVT type metadata, NVT discovery and Markdown technical
  details, and web_application_vt information payloads;
• forward-compatible handling of unknown future get_info subtypes;
• optional support-bundle encryption control with encrypted-by-default omission
  semantics;
• normalized discovered command names, stricter malformed-schedule rejection,
  correct task-tag membership filtering, and bounded mock command history;
• release binaries for five targets, each with a SHA-256 checksum;
• the Linux amd64/arm64 mock-server image at
  ghcr.io/greenbone-hive/gvm-mock-server:v0.8.0 (no moving latest tag);
• CycloneDX JSON and XML SBOMs, an SBOM quality report, checksums, and Sigstore
  provenance for downloadable artifacts and the container image.

The release artifacts are built from the immutable v0.8.0 tag and verified
against its exact qualified commit before publication completes.

rust-gvm 0.7.0

rust-gvm v0.7.0

rust-gvm v0.7.0 completes the canonical typed-request migration across the
five-crate workspace. Every supported GMP operation now has one authoritative
complete request type shared by encoding and client execution. Transitional
option bags, free XML builders, and duplicate forwarding facades have been
removed or explicitly retained only where compatibility policy requires them.

This is an intentional pre-1.0 breaking release. Callers upgrading from v0.6.0
must replace legacy split arguments and option structures with the canonical
*Request values documented in the
v0.7.0 migration guide.

Highlights:

• complete typed request/response execution through GmpClient::execute;
• fail-closed request validation before capability checks or transport;
• explicit version and semantic capability gates for newer gvmd operations;
• stateful mock-server coverage for canonical request families;
• preserved low-level send, call, and custom-codec escape hatches;
• release binaries for five targets, each with a SHA-256 checksum;
• the Linux amd64/arm64 mock-server image at
  ghcr.io/greenbone-hive/gvm-mock-server:v0.7.0 (no moving latest tag);
• CycloneDX JSON and XML SBOMs, an SBOM quality report, and their checksums;
• Sigstore attestations for the five binary archives, SBOM archive, and
  container image.

The release artifacts are built from the immutable v0.7.0 tag and verified
against its exact qualified commit before publication completes.

rust-gvm 0.6.0

0.6.0 - 2026-08-30

Added

• Support asynchronous scan report exports with capability discovery, typed and versioned clients, stateful mock behavior, and schema-backed tests (#522) (2a2045f)

Agent: Thoth
Model: openai/gpt-5.6-sol
Thinking: high

rust-gvm 0.5.1

0.5.1 - 2026-08-27

Added

• Expose typed credential kinds (#465) 83c28c9

Bug Fixes

• Align stateful task report history with GVMD (#490) d94f398
• Make target SSH credential ports lossless (#476) f6db0c8
• Clarify target port-list updates (#467) 7a91993

Agent: Thoth
Model: openai/gpt-5.6-sol
Thinking: high

rust-gvm 0.3.3

0.3.3 - 2026-06-18

Nightly Build (2026-03-30)

Automated nightly build from main branch.

⚠️ This is a development build — not recommended for production.

Built from commit: 2266d3e

rust-gvm 0.3.1

0.3.1 - 2026-03-24

rust-gvm 0.3.0

0.3.0 - 2026-03-24

Bug Fixes

• address security findings and code review issues (#28–#32) (#36) aff1dca